← Vulnerability feed

Vulnerability record · CVE-2019-9946 · published 2 April 2019

CVE-2019-9946: Cncf portmap vulnerability

Cncf · Portmap

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

7.5 CVSS 3.0 High EPSS 3.2% · top 12.5% CWE-670 · CWE-670
7.5CVSS 3.0 base score, v2 5.0
3.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHBA-2019:0862
https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272 PatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCN
https://security.netapp.com/advisory/ntap-20190416-0002/ PatchThird Party Advisory
https://access.redhat.com/errata/RHBA-2019:0862
https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272 PatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCN
https://security.netapp.com/advisory/ntap-20190416-0002/ PatchThird Party Advisory

Track CVE-2019-9946 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed9.8CVE-2018-1002105Kubernetes kube-apiserver proxy upgrade flaw enables backend accessThe kube-apiserver mishandles error responses to proxied upgrade requests, letting a crafted request establish a connection through the API server to…EPSS 87%analysed9.8CVE-2018-1002101Kubernetes vulnerabilityIn Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nod…EPSS 4.0%9.8CVE-2017-1000056Kubernetes missing authorization vulnerabilityKubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use…EPSS 2.8%9.8CVE-2016-1906Kubernetes permissions and access controls vulnerabilityOpenshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not al…EPSS 4.8%9.6CVE-2017-1002101Kubernetes link following vulnerabilityIn Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volum…EPSS 13%8.8CVE-2023-5528Kubernetes improper input validation vulnerabilityA security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to ad…EPSS 4.3%8.8CVE-2023-3676Kubernetes improper input validation vulnerabilityA security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those…EPSS 13%

Source: NIST National Vulnerability Database (record CVE-2019-9946), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.